Linux in Safety-Critical Applications
Total Page:16
File Type:pdf, Size:1020Kb
Die approbierte Originalversion dieser Diplom-/Masterarbeit ist an der Hauptbibliothek der Technischen Universität Wien aufgestellt (http://www.ub.tuwien.ac.at). The approved original version of this diploma or master thesis is available at the main library of the Vienna University of Technology (http://www.ub.tuwien.ac.at/englweb/). Linux in Safety-Critical Applications DIPLOMARBEIT zur Erlangung des akademischen Grades Diplom-Ingenieur im Rahmen des Studiums Technische Informatik eingereicht von Roland Kammerer Matrikelnummer 0125555 an der Fakultät für Informatik der Technischen Universität Wien ausgeführt am ICT - Institut für Computertechnik Betreuung: Betreuer: O. Univ. Prof. Dipl.-Ing. Dr. techn. Dietmar Dietrich Betreuer: Dipl.-Ing. Andreas Gerstinger Wien, 04. 11. 2008 (Unterschrift Verfasser) (Unterschrift Betreuer) Technische Universität Wien A-1040 Wien Karlsplatz 13 Tel. +43/(0)1/58801-0 http://www.tuwien.ac.at Kurzfassung Die heutige Gesellschaft ist von einer Vielzahl von sicherheitskritischen Systemen abh¨angig,die die Sicherheit der Benutzer und der Umwelt garantieren m¨ussen. Deshalb ist es entscheidend welches Betriebssystem auf solchen sicherheitskritischen Systemen zum Einsatz kommt. Diese Ar- beit untersucht einen m¨oglichen Einsatz des Kernels Linux und des Betriebssystems GNU/Linux f¨ursicherheitskritische Systeme. Um Vertrauen zu schaffen, dass GNU/Linux als Plattform f¨ur sicherheitskritische Anwendungen eingesetzt werden kann, wurde anhand von relevanter Literatur erforscht, wie Linux entwickelt und getestet wird. Das Open Source Entwicklungsmodell wurde mit traditionellen Entwicklungsmodellen vergleichen. Es wurde analysiert, ob der aktuelle Stand der Entwicklung die Anforderungen von existierenden Normen im Bereich sicherheitskritischer Anwendungen erf¨ullenkann. Um die Relevanz von Linux f¨ursicherheitskritische Anwendungen noch weiter zu erh¨ohen,wurden zwei Projekte implementiert. Das erste ist eine vollautoma- tische Testumgebung f¨urRAID-1 Systeme auf Kernelebene, das zweite ist ein Dateisystem, das schadhafte Daten erkennt und korrigiert. Es zeigt sich, dass das Verfahren der Open Source Entwicklung, das von der GNU/Linux Entwicklergemeinschaft eingesetzt wird, kein limitierender Faktor ist. Die meisten Standards, die sich mit sicherheitskritischen Systemen besch¨aftigen,sind flexibel genug, um Systeme, die auf neuen und offenen Wegen entwickelt wurden, zu zertifizieren. Dies f¨uhrtzum Ergebnis, dass Linux als Plattform f¨ursichheitskritische Anwendungen in Be- tracht gezogen werden sollte. Die Entwicklung von Linux hat in den letzen Jahren einen großen Fortschritt gemacht, der Linux reif f¨urden Einsatz in sicherheitskritischen Systemen macht. II Abstract Modern society depends on a range of systems that need to guarantee the safety of their users and the environment. Therefore it is crucial which operating system is used for such safety-critical systems. This thesis examines the potential use of the operating system kernel Linux, and the GNU/Linux operating system for safety-critical systems. To gain confidence that GNU/Linux can be used as a platform for safety-critical applications, it was examined how Linux is developed and tested by assembling information from relevant literature. This Open Source development model was compared to traditional software development models. It was analyzed, if the current state of development can fulfil the requirements of existing safety-related standards. To further improve the relevance of Linux for safety-critical systems, two projects have been implemented. The first one is a fully automatic test suite for kernel-level software RAID-1 systems, the second one is a wrapper file system that detects and corrects faulty data on hard disks. It turns out that the Open Source development approach taken by the GNU/Linux community is not a limiting factor for its use in safety-critical applications. Most standards that deal with safety-critical systems are flexible enough to certify systems that are developed in new and open ways. As a result, Linux should be considerd as a platform for safety-critical systems. The development of Linux made large progress during the last years, which makes Linux fit for safety-critical systems. III Acknowledgements First of all I would like to thank my parents for giving me financial and personal support during my whole lifetime. Thanks to Andreas Gerstinger for his endless patience and the ability to talk to people involved in Linux kernel development. Thanks to Wolfgang Puffitsch for reviewing my source code and to Daniel Schneider for proof-reading. Thanks to my fellow students and true friends Harald Krapfenbauer and Wolfgang Puffitsch for all their support and interesting discussions during the last years. Last but not least I would like to thank all the Linux kernel hackers and the GNU project for providing such great software, which makes computer science that much fun for me. IV Table of Contents 1 Introduction 1 1.1 Problem Description...................................1 1.2 Intentions.........................................2 1.3 Method..........................................2 2 Linux and GNU/Linux3 2.1 Free and Open Source Software.............................4 2.2 History..........................................5 2.3 Features and Design...................................6 2.4 Development Process................................... 10 2.4.1 Software Development - The Traditional Way................. 10 2.4.2 Kernel Development - The Open Source Way................. 17 2.4.3 Kernel Management - The git Way....................... 18 2.4.4 Release Cycle................................... 21 2.4.5 The Modularity of Linux and GNU/Linux Distributions........... 22 2.4.6 FreeBSD...................................... 26 2.5 Testing, Standardization and Backports........................ 28 2.5.1 Testing and Standardization........................... 28 2.5.2 Backports..................................... 31 3 Safety 33 3.1 Definition of Safety.................................... 33 3.2 Dependability....................................... 35 3.2.1 Threats...................................... 35 3.2.2 Attributes..................................... 37 3.2.3 Means....................................... 38 3.3 Testing.......................................... 41 3.3.1 Black-Box Testing................................ 42 3.3.2 White-Box Testing................................ 43 3.3.3 Fault Injection.................................. 46 3.4 Safety-Related Standards................................ 49 3.4.1 Safe State..................................... 50 3.4.2 Requirements in Different Safety-Related Standards............. 51 3.5 COTS........................................... 55 3.5.1 Definition of COTS............................... 55 V 3.5.2 GNU/Linux Distributors and Their COTS Products............. 57 4 Related Work 65 4.1 Preliminary Assessment of Linux for Safety-Related Systems............ 65 4.2 COTS Components in Safety-Critical Systems..................... 67 4.3 Further Important Work................................. 71 4.3.1 Linux and Real-Time.............................. 71 4.3.2 Linux, Safety, and COTS............................ 72 5 Improving Linux for Safety-Critical Applications 74 5.1 A Test-Suite for Kernel Level RAID-1 Systems - raid1test.............. 74 5.1.1 Implementation.................................. 75 5.1.2 Configuration................................... 83 5.1.3 Test Results.................................... 88 5.2 A File System for Safety-Critical Applications - tinysafefs.............. 89 5.2.1 FUSE....................................... 89 5.2.2 Features...................................... 89 5.2.3 Implementation.................................. 92 5.2.4 Configuration................................... 98 5.2.5 Test Results.................................... 99 6 Conclusion 100 Appendices 104 A Extreme Programming 104 B Selected Source Code 107 B.1 raid1test.......................................... 107 B.2 tinysafefs......................................... 112 Literature 113 Internet References 117 VI Abbreviations API Application Programming Interface BSD Berkeley Software Distribution COTS Commercial/Component Off The Shelf CPU Central Processing Unit CVS Concurrent Versions System FC Failure Case FMEA Failure Mode and Effect Analysis FOSS Free and Open Source Software FS Free Software FTA Fault Tree Analysis GDB GNU Project Debugger GNU GNU's Not Unix GPG GNU Privacy Guard GPL GNU Public Licence GUI Graphical User Interface HRT Hard Real-Time HTML HyperText Markup Language IPC Inter Process Communication ISV Independent Software Vendor KVM Kernel-based Virtual Machine LF Linux Foundation LSB Linux Standard Base LTP Linux Test Project MIT Massachusetts Institute of Technology MMU Memory Management Unit MTA Mail Transfer Agent MTBF Mean Time Between Failures MTTF Mean Time To Failure VII MTTR Mean Time To Repair MULTICS Multiplexed Information and Computation System. NC Normal Case NIC Network Interface Card NPTL Native POSIX Thread Library NUMA Non Uniform Memory Access OEM Original Equipment Manufacturer OSADL Open Source Automation Development Lab OSDL Open Source Development Labs OSS Open Source Software PGP Pretty Good Privacy POSIX Portable Operating System Interface QoS Quality of Service RAID Redundant Array of Inexpensive Disks RAMS Reliability, Availability, Maintainability, and Safety RHMRG Red Hat Messaging, Real Time Grid RTDM Real-Time Driver Model SCI System Call Interface SCSI